Linux kernel megaraid_sas: NVMe PRP list overruns the chain frame and corrupts other in-flight commands

Impact

megasas_make_prp_nvme() builds the PRP list for an NVMe passthrough transfer in a DMA-pool buffer of max_chain_frame_sz bytes and never checks that bound. Since the block layer default cap rose to 4 MiB, a drive reporting a large MDTS lets a single ordinary transfer need ~1025 entries against a 4 KiB frame that holds 512, so the write runs a full page past the end of the buffer. If the following page is mapped there is no oops - it silently overwrites the neighbouring pool entry, which is another in-flight command's PRP list, so one tenant's I/O can be steered into memory belonging to another request. On GPU nodes that front their NVMe scratch or dataset cache behind a MegaRAID controller this is reachable from normal large I/O, not from a crafted command, and the failure mode is silent data corruption rather than a clean crash.

Who can reach it

Local. Any workload on the node that can issue large block I/O to an NVMe drive behind a MegaRAID controller whose firmware reports a large MDTS; no special privilege beyond access to the block device. Not reachable from the network.

What to do

Take the stable kernel fix that caps max_hw_sectors at what the chain frame can describe (commits 4bb34769ef44, 4dd118d06dec, af8c27375733). This is a kernel change: install the patched kernel and reboot each affected node - drain GPU workloads first, as the fix cannot be applied live. No vendor workaround is named in the record; lowering the block device max_sectors_kb below what the chain frame can describe reduces exposure in the meantime.

References

Related entries

• Linux kernel SCSI bsg: TOCTOU on the shared io_uring SQE overflows the SCSI command bufferCVE-2026-90009 · Linux kernel SCSI bsg (io_uring passthrough command setup)High
• Linux kernel bsg: sense data copy ignores max_response_len and overruns the user bufferCVE-2026-90010 · Linux kernel SCSI bsg (io_uring sense copy)High
• Linux kernel page allocator: unsafe spin_trylock in NMI context on uniprocessor buildsCVE-2026-90046 · Linux kernel mm/page_alloc (free_pages_nolock in NMI on UP builds)High
• Linux kernel virtio-gpu: unvalidated EDID block offset lets a malicious backend read past a kernel bufferCVE-2026-68255 · Linux kernel drm/virtio (virtio_get_edid_block response bounds)High
• Linux kernel (drivers/pci): The option-ROM parser trusts the header and data-structure offsets it reads out of theCVE-2026-72487 · Linux kernel (drivers/pci)High
• Xen qemu-xen-traditional device model hw/pt-msi.c (MSI-X passthrough): Buffer overflow on the MSI-X table write pathCVE-2015-8554 · Xen qemu-xen-traditional device model hw/pt-msi.c (MSI-X passthrough)High